Network Security and Architecture GISF Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which security function is primarily performed by a firewall?

   • AForwarding packets based on IP addresses
   • BTranslating private IP addresses to public ones
   • CDetecting and alerting on known attack signatures
   • DFiltering traffic based on rules
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's web application allows users to log in over HTTP. A recent audit found that credentials were captured by an attacker performing a man-in-the-middle attack. The company wants to protect user credentials in transit without changing the application's authentication logic. Which solution best addresses the issue?

   • ASwitch the application to use digest authentication over HTTP.
   • BUse HTTP Strict Transport Security (HSTS) headers on the web server.
   • CImplement IPsec between the client and the web server.
   • DImplement TLS by installing a valid certificate on the web server and redirecting all HTTP traffic to HTTPS.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network monitoring system flags a sudden increase in outbound traffic from a single workstation to multiple external IP addresses on port 53. The workstation is not a DNS server. Which type of activity does this pattern suggest?

   • AA misconfigured DNS server on the workstation.
   • BNormal DNS resolution, as all workstations send DNS queries.
   • CA distributed denial-of-service (DDoS) attack originating from the workstation.
   • DDNS tunneling, where the workstation is exfiltrating data by encoding it in DNS queries.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security analyst is investigating a possible data exfiltration. The analyst sees that a workstation is communicating with an external IP on port 443, which is normally used for HTTPS. The traffic volume is unusually high, and the analyst suspects the workstation is tunneling data over HTTPS. Which action would best confirm the suspicion without disrupting the user's work?

   • ARun a full antivirus scan on the workstation.
   • BDisable the workstation's network adapter.
   • CBlock port 443 to the external IP immediately.
   • DCapture the traffic and inspect the TLS certificates and session behavior, such as the destination and data patterns.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is designing a new network for a research lab that handles sensitive data. The lab's network must be isolated from the corporate network, but researchers need to access the internet and occasionally share files with corporate users. Which design best meets the requirement?

   • APlace the lab in a separate VLAN with a firewall between the lab and the corporate network, and allow only specific file-sharing ports.
   • BUse a router with a single ACL that blocks all traffic between the lab and corporate network.
   • CPut the lab on the same subnet as the corporate network but use host-based firewalls on each lab machine.
   • DConnect the lab directly to the corporate network with no filtering.
   Reveal Solution Discussion Select an answer first